Security: vitest-dev/vitest
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Path Traversal / Arbitrary File Read via @vitest/mocker Redirect MockGHSA-82fw-gwwq-j7x9 published
Aug 18, 2026 by sheremet-vaModerate -
Browser Mode provider commands bypass the file-access permission gateGHSA-p63j-vcc4-9vmv published
Jul 8, 2026 by hi-ogawaCritical -
Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCEGHSA-g8mr-85jm-7xhm published
Jun 1, 2026 by sheremet-vaCritical -
Vitest browser mode serves unsanitized otelCarrier query parameter as inline scriptGHSA-2h32-95rg-cppp published
May 19, 2026 by hi-ogawaCritical -
Arbitrary file can be read and executed when Vitest UI server is listeningGHSA-5xrq-8626-4rwp published
May 19, 2026 by hi-ogawaCritical -
Browser mode serves arbitrary filesGHSA-8gvc-j273-4wm5 published
Feb 4, 2025 by sheremet-vaModerate -
Remote Code Execution when accessing a malicious website while Vitest API server is listeningGHSA-9crc-q9x8-hgqq published
Feb 4, 2025 by sheremet-vaCritical